Executive brief
PocketMine-MP is a Minecraft Bedrock server implementation. An authenticated attacker can crash the server by sending specially crafted network packets with invalid data, causing a denial of service that disrupts gameplay for all connected players.
Technical details
The vulnerability is an input validation failure in PocketMine-MP's packet handling code. Specifically, the server does not validate that "facing" values in PlayerActionPacket (for START_BREAK and CRACK_BLOCK actions) and UseItemTransactionData are within the valid range of 0–5. An authenticated, network-reachable attacker can send PlayerActionPacket or InventoryTransactionPacket with out-of-range or negative facing values to trigger an unhandled exception and crash the server process. The fix, implemented in version 4.0.6, adds explicit validation of facing values before processing these packets.
Affected products
- PocketMine PocketMine-MP before 4.0.6
Timeline
- 2022-01-13: disclosed
- 2022: patched: Fixed in version 4.0.6 via commit f126479c37ff00a717a828f5271cf8e821d12d6c